CVE-2017-1000251
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 16.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.
- CVSS 3.1
- 8.0 HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 16.18% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- linux/linux kernel · debian/debian linux · nvidia/jetson tk1 · nvidia/jetson tx1 · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server eus · redhat/enterprise linux server tus · redhat/enterprise linux workstation
- Source
- cve@mitre.org
References
- http://nvidia.custhelp.com/app/answers/detail/a_id/4561Third Party Advisory
- http://www.debian.org/security/2017/dsa-3981Third Party Advisory
- http://www.securityfocus.com/bid/100809Patch, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039373Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:2679Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2680Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2681Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2682Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2683Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2704Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2705Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2706Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2707Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2731Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2732Third Party Advisory
- https://access.redhat.com/security/vulnerabilities/blueborneThird Party Advisory
- https://github.com/torvalds/linux/commit/f2fcfcd670257236ebf2088bbdf26f6a8ef459fePatch, Third Party Advisory
- https://www.armis.com/blueborneThird Party Advisory
- https://www.exploit-db.com/exploits/42762/Exploit, Third Party Advisory, VDB Entry
- https://www.kb.cert.org/vuls/id/240311Third Party Advisory, US Government Resource
- https://www.synology.com/support/security/Synology_SA_17_52_BlueBorneThird Party Advisory
- http://nvidia.custhelp.com/app/answers/detail/a_id/4561Third Party Advisory
- http://www.debian.org/security/2017/dsa-3981Third Party Advisory
- http://www.securityfocus.com/bid/100809Patch, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039373Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:2679Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2680Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2681Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2682Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2683Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.